零查询攻击：用特征图欺骗目标模型，无需多次尝试。
ZQBA: Zero Query Black-box Adversarial Attack
- 利用深度网络特征图直接构造对抗样本，无需大量查询。
- 单次查询即可实现跨模型、跨数据集攻击，效果优于现有方法。
- 攻击隐蔽性强，适合研究模型安全漏洞的人员使用。
当前黑盒对抗攻击要么需要多次查询，要么依赖扩散模型生成对抗样本，但这些方法需训练代理损失或扩散模型，限制了其在真实场景的应用。为此，我们提出零查询黑盒攻击（ZQBA），利用深度神经网络（DNN）的特征表示来误导其他网络。与需要数千次查询的方法不同，ZQBA直接将从DNN获取的特征图添加到原始图像上，从而干扰目标模型分类。实验表明，ZQBA能有效迁移至不同模型和多个数据集（如CIFAR和Tiny ImageNet），在仅一次查询下表现优于现有先进黑盒攻击，同时保持扰动的不可察觉性（通过SSIM定量评估及定性观察）。结果凸显了在真实场景中使用DNN存在的安全风险。所有源代码已公开于https://github.com/Joana-Cabral/ZQBA。
原文摘要 · Abstract (English)
Current black-box adversarial attacks either require multiple queries or diffusion models to produce adversarial samples that can impair the target model performance. However, these methods require training a surrogate loss or diffusion models to produce adversarial samples, which limits their applicability in real-world settings. Thus, we propose a Zero Query Black-box Adversarial (ZQBA) attack that exploits the representations of Deep Neural Networks (DNNs) to fool other networks. Instead of requiring thousands of queries to produce deceiving adversarial samples, we use the feature maps obtained from a DNN and add them to clean images to impair the classification of a target model. The results suggest that ZQBA can transfer the adversarial samples to different models and across various datasets, namely CIFAR and Tiny ImageNet. The experiments also show that ZQBA is more effective than state-of-the-art black-box attacks with a single query, while maintaining the imperceptibility of perturbations, evaluated both quantitatively (SSIM) and qualitatively, emphasizing the vulnerabilities of employing DNNs in real-world contexts. All the source code is available at https://github.com/Joana-Cabral/ZQBA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。